iankelling.org Git - automated-distro-installer/blob - fai/config/scripts/IANK/11-iank

   1 #!/bin/bash -x
   2 # This file is part of Ian Kelling's automated-distro-installer
   3 # Copyright (C) 2024 Ian Kelling
   4
   5 # This program is free software; you can redistribute it and/or
   6 # modify it under the terms of the GNU General Public License
   7 # as published by the Free Software Foundation; either version 2
   8 # of the License, or (at your option) any later version.
   9
  10 # This program is distributed in the hope that it will be useful,
  11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 # GNU General Public License for more details.
  14
  15 # You should have received a copy of the GNU General Public License
  16 # along with this program; if not, write to the Free Software
  17 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  18
  19 set -eE -o pipefail
  20 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
  21
  22 if [[ $EUID != 0 ]]; then
  23   echo "$0: error: expected to be root."
  24   exit 1
  25 fi
  26
  27 if ! type -t fcopy &>/dev/null; then
  28   sudo apt-get -y install fai-client
  29 fi
  30
  31 # -r = recursive
  32 # -i = ignore non-matching class warnings, always exit 0
  33 # -B = no backup files
  34 fcopy -riB /boot
  35 # this is also done by FAIBASE/10-misc by default (without B)
  36 fcopy -riB /usr/local/bin
  37
  38 fcopy -riB /etc/apt/logind.conf.d
  39
  40 # this gets done by fai, but just happens too often that
  41 # I add sources due to new distros, whatever.
  42 fcopy -riB /etc/apt/preferences.d
  43 fcopy -riB /etc/apt/sources.list.d
  44
  45
  46 src=$FAI/distro-install-common/shadow
  47 dst=/q/root/shadow
  48 if [[ ! -e $dst && -e $src ]]; then
  49   # outside of fai context, we skip this
  50   mkdir -p $dst
  51   mount -o bind $src $dst
  52 fi
  53
  54
  55
  56 $FAI/distro-install-common/end
  57
  58
  59
  60 ### begin sources install + updates
  61 # these get copied in an earlier stage by fai, but leaving it here since
  62 # I run this as a single post-fai script to update things that have changed.
  63 tmpfile1=$(mktemp)
  64 # this can fail if we need an apt update
  65 $ROOTCMD /usr/bin/apt-cache policy >$tmpfile1 ||:
  66 fcopy -riB /etc/apt
  67
  68 tmpfile2=$(mktemp)
  69 $ROOTCMD /usr/bin/apt-cache policy >$tmpfile2
  70 if ! diff -q $tmpfile1 $tmpfile2; then
  71   $ROOTCMD /usr/bin/apt update
  72 fi
  73 # outside of fai, this seems to regularly lead to
  74 # E: Could not get lock /var/lib/apt/lists/lock - open (11: Resource temporarily unavailable)
  75 # so add a sleep. 1 sec is probably way more than needed.
  76 sleep 1
  77 f=$FAI_ROOT/var/cache/apt/pkgcache.bin
  78 if [[ ! -r $f ]] || (( $(( $(date +%s) - $(stat -c %Y $f ) )) > 60*60*2 )); then
  79   i=0
  80   while fuser $FAI_ROOT/var/lib/dpkg/lock &>/dev/null; do
  81     sleep 1
  82     i=$(( i+1 ))
  83     if (( i > 300 )); then
  84       echo "error: timed out waiting for /var/lib/dpkg/lock" >&2
  85       exit 1
  86     fi
  87     $ROOTCMD apt-get update
  88   done
  89 fi
  90 ### end sources install + updates
  91
  92
  93 #### misc configurations
  94
  95 if [[ $FAI_ACTION != dirinstall ]] && ! ifclass NOCRYPT; then
  96   if ifclass LINODE; then
  97     speed=19200
  98     cmdline="rd.luks.crypttab=no net.ifnames=0 console=ttyS0,${speed}n8"
  99   else
 100     speed=115200
 101     cmdline="rd.luks.crypttab=no net.ifnames=0 console=ttyS0,${speed}n8 console=tty0"
 102     case $HOSTNAME in
 103       kd)
 104         fcopy -v /usr/bin/myncq
 105
 106         cat >$target/etc/systemd/system/myncq.service <<'EOF'
 107 [Unit]
 108 Description=fix ncq errors
 109
 110 [Service]
 111 Type=oneshot
 112 ExecStart=/usr/bin/myncq
 113 TimeoutStartSec=20
 114
 115 [Install]
 116 # https://www.enricozini.org/blog/2017/debian/systemd-07-devices/
 117 WantedBy=dev-disk-by\x2did-ata\x2dSamsung_SSD_870_QVO_8TB_S5VUNG0N900656V.device
 118 EOF
 119
 120         $ROOTCMD bash <<'EOFOUTER'
 121 systemctl enable myncq.service
 122 /usr/bin/myncq no-upgrub
 123 EOFOUTER
 124
 125         ;;&
 126       # per rubens suggestion to make a d16 more stable
 127       kd|kw) cmdline+=" pci=realloc=off" ;;
 128     esac
 129   fi
 130
 131 fi ##### end != dirinstall && != NOCRYPT
 132
 133
 134 ###### begin network setup ####
 135
 136 # use old names. the idea of them changing between boots has never
 137 # happened to me and I usually only have 1 wired or other type.
 138 # If I ever do need to care about it, I will.
 139 # Strangely this didn't work on kw, so I added kernel cmdline parameter.
 140 # https://www.freedesktop.org/wiki/Software/systemd/PredictableNetworkInterfaceNames/
 141 ln -sf /dev/null $target/etc/systemd/network/99-default.link
 142
 143
 144 # bitfolk installer handles the rest
 145 case $HOSTNAME in
 146   bk|je) exit 0 ;;
 147 esac
 148
 149
 150 # bug fix, somewhere between t9's xorg 1.19.6
 151 # and 1.20.1-3ubuntu2
 152 #  xserver-xorg-video-nouveau                 1:1.0.15-3
 153 # xorg stopped load nouveau
 154 #  https://www.linuxquestions.org/questions/slackware-14/kernel-modules-conflicting-with-nouveau-driver-4175623867/
 155 # https://nouveau.freedesktop.org/InstallNouveau.html
 156 # And now in t11, things got worse with a newer card also not loading
 157 # nouveau when it did in t10.
 158 if lspci|grep -q 'VGA compatible controller: NVIDIA'; then
 159   mkdir -p $target/etc/X11/xorg.conf.d/
 160   cat >$target/etc/X11/xorg.conf.d/10-nouveau.conf <<'EOF'
 161 Section "Device"
 162 Identifier "Device0"
 163 Driver "nouveau"
 164 EndSection
 165 EOF
 166 fi
 167
 168 # use networkmanager if this host has wireless.
 169 if [[ $(iw dev) ]]; then
 170   $ROOTCMD bash -xe <<EOF
 171 apt-get -y install network-manager
 172 EOF
 173
 174   # allow networkmanager to manage interfaces
 175   #https://bugs.launchpad.net/ubuntu/+source/network-manager/+bug/1638842
 176   touch $target/etc/NetworkManager/conf.d/10-globally-managed-devices.conf
 177   # in a default desktop install, it looks like netplan creates this file under
 178   # run/NetworkManager/conf.d in early boot.
 179
 180   # By default, dns=default is set in etiona, and dns is just broken.
 181   # Maybe with resolvconf it would work, but theres no need for that.
 182   # https://wiki.gnome.org/Projects/NetworkManager/DNS
 183   cat >$target/etc/NetworkManager/conf.d/99-iank.conf <<'EOF'
 184 [main]
 185 dns=systemd-resolved
 186 EOF
 187 else
 188   cat > $target/etc/network/interfaces <<-EOF
 189 # generated by FAI
 190 auto lo eth0
 191 iface lo inet loopback
 192 iface eth0 inet dhcp
 193 iface eth0 inet6 auto
 194
 195 source-directory /etc/network/interfaces.d
 196 EOF
 197
 198   # previously had an else condition after
 199   #elif ifclass VM || ifclass LINODE; then
 200   # iface $NIC1 inet manual
 201   # iface br0 inet dhcp
 202   #   bridge_ports $NIC1
 203   #   bridge_stp off
 204   #   bridge_maxwait 0
 205   # however, on t9, on startup, br0, became
 206   # rename1 and didn't come up. i dunno why,
 207   # but the bridge is for vms that I rarely use,
 208   # so not bothering to figure it out.
 209
 210
 211 fi
 212
 213 if ifclass LINODE; then
 214   mkdir -p $target/etc/initramfs-tools/conf.d
 215   cat >$target/etc/initramfs-tools/conf.d/mine <<EOF
 216 # dhcp in initramfs doesn't work on linode. i dunno why, whatever.
 217 # man 5 initramfs.conf
 218 # /usr/share/doc/klibc-utils/README.ipconfig.gz
 219 # /usr/share/initramfs-tools/scripts/functions
 220 IP=$linode_ip::$linode_gw:255.255.255.0::eth0:off
 221 EOF
 222
 223
 224   if [[ $HOSTNAME == li ]]; then
 225     cat > $target/etc/network/interfaces <<-EOF
 226 # generated by FAI
 227 auto lo eth0
 228 iface lo inet loopback
 229 iface eth0 inet dhcp
 230 # for the standard network config, uncomment this and comment the lines after it.
 231 #iface eth0 inet6 auto
 232
 233 iface eth0 inet6 static
 234 # this is really a /128. it seems like we need to assign it for ipv6 to work.
 235 address 2600:3c00::f03c:91ff:fe6d:baf8/64
 236 gateway fe80::1
 237
 238 iface eth0 inet6 static
 239 # from a requested /64 pool
 240 address 2600:3c00:e000:280::2/64
 241
 242 source-directory /etc/network/interfaces.d
 243 EOF
 244   fi
 245 fi
 246
 247
 248 ##### end network setup  #####
 249
 250
 251 if ifclass VOL_BULLSEYE_BOOTSTRAP || ifclass VOL_BOOKWORM_BOOTSTRAP; then
 252   fcopy /etc/systemd/system/faicheck.service
 253   $ROOTCMD bash <<'EOFOUTER'
 254 systemctl enable faicheck.service
 255 EOFOUTER
 256   exit 0 # avoid unnecessary stuff in bootstrap vol
 257 fi
 258
 259
 260 ## misc settings
 261 $ROOTCMD bash <<'EOFOUTER'
 262 #### begin .ssh setup ###
 263 set -x
 264 set -eE -o pipefail
 265 if ! [[ -s /home/iank/.ssh/authorized_keys ]]; then
 266   mkdir -p /home/iank/.ssh
 267   f=/root/.ssh/authorized_keys
 268   if [[ -e $f ]]; then
 269      cp $f /home/iank/.ssh
 270   fi
 271   chown -R 1000:1000 /home/iank/.ssh
 272   chmod -R u=Xrw,og= /home/iank/.ssh
 273   rm -rf /root/.ssh
 274   # remove broken symlinks or the following cp will fail
 275   find /home/iank/.ssh -xtype l -exec rm '{}' \;
 276   cp -rL /home/iank/.ssh /root
 277   chown -R root:root /root/.ssh
 278   chmod 700 /root/.ssh
 279 fi
 280
 281 # old link from
 282 # # https://ticktockhouse.svbtle.com/my-obligatory-ubuntu-ssh-agent-post
 283 # but that made a service that started too soon and didn't pick up our
 284 # x env vars. instead, copy from the root ssh-agent just the
 285 # appropriate things into a new service.
 286
 287 rm -f /home/iank/.local/share/systemd/user/sshaiank.service \
 288   /home/iank/.config/systemd/user/default.target.wants/sshaiank.service
 289
 290 #### end .ssh setup ###
 291
 292 ## duplicated in ssh-emacs-setup
 293 # done here so its setup earlier for convenience
 294 line='AcceptEnv INSIDE_EMACS BRC COLUMNS'
 295 f=/etc/ssh/sshd_config
 296 grep -xFq "$line" $f || tee -a $f <<<"$line"
 297
 298
 299 # default debian groups (jessie through buster) + adm, root, admin
 300 for g in cdrom floppy audio dip video plugdev netdev adm sudo admin; do
 301   if getent group $g >/dev/null; then
 302     usermod -aG $g iank
 303   fi
 304 done
 305
 306 if getent group systemd-journal >/dev/null; then
 307   usermod -aG systemd-journal iank
 308 fi
 309 EOFOUTER
 310
 311 rm -f $target/etc/resolv.conf
 312 ln -s ../run/systemd/resolve/stub-resolv.conf $target/etc/resolv.conf
 313 # needed for bitfolk image
 314 if [[ -e /a/bin/fai/fai-wrapper ]]; then
 315   systemctl enable systemd-resolved
 316   systemctl start systemd-resolved
 317 fi
 318
 319
 320
 321 # reading through the groups that iank is in but user2 isn't,
 322 for g in plugdev audio video cdrom; do
 323   $ROOTCMD usermod -a -G $g user2
 324 done
 325
 326
 327 ## begin get new kernel and btrfs-progs ##
 328 case $HOSTNAME in
 329   sy|so)
 330     $FAI/distro-install-common/install-stable-kernel-debs
 331     ;;
 332   *)
 333     $ROOTCMD apt-get -y install linux-libre
 334     ;;
 335 esac
 336
 337 pre=https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/btrfs-progs
 338 tarball=$(curl -s $pre/sha256sums.asc \
 339             | awk '$2 ~ /^btrfs-progs-v/ { print $2 }' | grep -v -- -rc | grep "^btrfs-progs-v.*gz\$" | sort -V | tail -n1)
 340 url="$pre/$tarball"
 341 dir=${tarball%.tar.gz}
 342 ver=${dir#btrfs-progs-}
 343 cur_ver=$($ROOTCMD btrfs --version 2>/dev/null | awk '{print $2}') ||:
 344
 345 if [[ $FAI_ROOT == / ]]; then
 346   bp_dir=/a/opt/btrfs-progs-release
 347 else
 348   bp_dir=$FAI/distro-install-common/btrfs-progs-release
 349 fi
 350 if [[ $ver != "$cur_ver" ]]; then
 351   if [[ $ver != "$($bp_dir/btrfs --version 2>/dev/null | awk '{print $2}')" ]]; then
 352     cd $target/tmp
 353     wget $url
 354     tar xzf $tarball
 355     $ROOTCMD apt-get -y build-dep btrfs-progs
 356     # no docs cuz I didn't want to bother fixing error of missing docs dependencies
 357     $ROOTCMD bash -xe <<EOF
 358 cd /tmp/${tarball%.tar.gz}
 359 ./configure --disable-documentation
 360 make
 361 make install
 362 EOF
 363     # If our desktop is HOST2, will we btrbk this latest bprogs to other
 364     # machines.
 365     if [[ -s /a/bin/bash_unpublished/source-state ]]; then
 366       source /a/bin/bash_unpublished/source-state
 367     fi
 368     if [[ $HOST2 == "$HOSTNAME" && $FAI_ROOT != / ]]; then
 369       rm -rf $bp_dir
 370       chown -R iank:iank $target/tmp/${tarball%.tar.gz}
 371       mv $target/tmp/${tarball%.tar.gz} $bp_dir
 372     fi
 373   else
 374     if ! $ROOTCMD dpkg -s -- build-essential  2>&1 | grep -Fx "Status: install ok installed" &>/dev/null; then
 375       $ROOTCMD apt-get -y install build-essential
 376     fi
 377
 378     if [[ $FAI_ROOT == / ]]; then
 379       cd /a/opt/btrfs-progs-release
 380       make install
 381     else
 382       mkdir -p $target/tmp/bprogs
 383       mount -o bind $bp_dir $target/tmp/bprogs
 384       $ROOTCMD bash -xe <<EOF
 385 cd /tmp/bprogs
 386 make install
 387 EOF
 388     fi
 389   fi
 390 fi
 391 ## end get new kernel and btrfs-progs ##